For Public Release 2010 January 20 1600 UTC (GMT)
+---------------------------------------------------------------------

Summary

CiscoWorks Internetwork Performance Monitor (IPM) versions 2.6 and
earlier for Microsoft Windows operating systems contain a buffer
overflow vulnerability that could allow a remote unauthenticated
attacker to execute arbitrary code. There are no workarounds for this
vulnerability.

CiscoWorks IPM version 2.x for Sun Solaris and CiscoWorks IPM version
4.x for Windows and Solaris operating systems are not affected. No
other Cisco products are currently known to be affected by this
vulnerability.

Details

CiscoWorks IPM is a troubleshooting application that gauges network
response time and availability. CiscoWorks IPM is available as a
component within the CiscoWorks LAN Management Solution (LMS) bundle.
CiscoWorks IPM versions 2.6 and earlier for Windows contain a buffer
overflow vulnerability when processing Common Object Request Broker
Architecture (CORBA) GIOP requests. By sending a crafted CORBA GIOP
request, a remote, unauthenticated attacker may be able to trigger
the buffer overflow condition and execute arbitrary code with SYSTEM
privileges on affected Windows systems. This vulnerability is
documented in Cisco Bug ID CSCsv62350 and has been assigned the
Common Vulnerabilities and Exposures (CVE) CVE-2010-0138.

Vulnerability Scoring Details

Cisco has provided scores for the vulnerabilities in this advisory
based on the Common Vulnerability Scoring System (CVSS). The CVSS
scoring in this Security Advisory is done in accordance with CVSS
version 2.0.

CVSS is a standards-based scoring method that conveys vulnerability
severity and helps determine urgency and priority of response.

Cisco has provided a base and temporal score. Customers can then
compute environmental scores to assist in determining the impact of
the vulnerability in individual networks.

Successful exploitation of the vulnerability may result in the
ability to execute arbitrary code with SYSTEM privileges on affected
Windows systems.

Software Versions and Fixes

Ciscoworks IPM versions 2.6 and earlier for Windows contain a
vulnerable third-party component that is no longer supported. Cisco
is unable to provide updated software for affected CiscoWorks
versions. Consult the "Obtaining Fixed Software" section of this
advisory for instructions on how to address vulnerable systems.

Workarounds

There are no workarounds for this vulnerability. It is possible to
mitigate this vulnerability by restricting network access to TCP
ports on an affected Windows system running IPM versions 2.6 and
earlier to trusted systems.

Additional mitigation techniques that can be deployed on Cisco
devices within the network are available in the Cisco Applied
Mitigation Bulletin companion document for this advisory:

Ciscoworks IPM versions 2.6 and earlier for Windows contain a
vulnerable third-party component that is no longer supported. Cisco
is unable to provide updated software for affected CiscoWorks
versions.

Customers with active software licenses for the IPM component of
CiscoWorks versions 2.6 and earlier for Windows should send email to
the following address for instructions on migrating to non-vulnerable
software:

ipm-corba-fix@cisco.com

Exploitation and Public Announcements

The Cisco PSIRT is not aware of any public announcements or malicious
use of the vulnerability described in this advisory.

This vulnerability was discovered and reported to Cisco by
TippingPoint. Cisco would like to thank TippingPoint for reporting
this vulnerability to us and for working with us on a coordinated
disclosure.

Status of this Notice: FINAL

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY
KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE
INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS
AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS
DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that
omits the distribution URL in the following section is an
uncontrolled copy, and may lack important information or contain
factual errors.

In addition to worldwide web posting, a text version of this notice
is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.

cust-security-announce@cisco.com

first-bulletins@lists.first.org

bugtraq@securityfocus.com

vulnwatch@vulnwatch.org

cisco@spot.colorado.edu

cisco-nsp@puck.nether.net

full-disclosure@lists.grok.org.uk

comp.dcom.sys.cisco@newsgate.cisco.com

Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the above URL for any updates.